perf: keep session validation off event loop (#275)

src/dashboard_auth.py

@@ -1,5 +1,6 @@
 """Signed, short-lived single-operator sessions for the dashboard boundary."""
 
+import asyncio
 import base64
 import hashlib
 import hmac
@@ -139,8 +140,8 @@ def revoke_session(session: Session) -> None:
     _session_store().revoke(session.session_id)
 
 
-def request_session(request: Request) -> Session | None:
-    return verify_session(request.cookies.get(SESSION_COOKIE))
+async def request_session(request: Request) -> Session | None:
+    return await asyncio.to_thread(verify_session, request.cookies.get(SESSION_COOKIE))
 
 
 def cookie_path(request: Request) -> str:

src/main.py

@@ -470,14 +470,16 @@ async def require_operator_session(request: Request, call_next):
         or path.startswith("/static/")
         or (path == "/api/v1/session" and request.method == "POST")
     )
-    try:
-        session = dashboard_auth.request_session(request)
-    except dashboard_auth.SessionStoreError:
-        return JSONResponse(
-            {"detail": "Session registry is temporarily unavailable"},
-            status_code=503,
-            headers={"Cache-Control": "no-store"},
-        )
+    session = None
+    if not public:
+        try:
+            session = await dashboard_auth.request_session(request)
+        except dashboard_auth.SessionStoreError:
+            return JSONResponse(
+                {"detail": "Session registry is temporarily unavailable"},
+                status_code=503,
+                headers={"Cache-Control": "no-store"},
+            )
     if not public and session is None:
         if path.startswith("/api/"):
             return JSONResponse(
@@ -615,7 +617,7 @@ async def sign_in(payload: DashboardSignIn, request: Request, response: Response
 
 @app.get("/api/v1/session")
 async def session_status(request: Request):
-    session = dashboard_auth.request_session(request)
+    session = request.state.dashboard_session
     return {
         "authenticated": session is not None,
         "csrf_token": session.csrf if session is not None else "",

src/session_store.py

@@ -26,25 +26,35 @@ class SessionStore:
     def _digest(session_id: str) -> str:
         return hashlib.sha256(session_id.encode()).hexdigest()
 
-    def _connect(self) -> sqlite3.Connection:
+    def _connect(self, *, initialize: bool = False) -> sqlite3.Connection:
         try:
-            self.path.parent.mkdir(parents=True, exist_ok=True)
-            connection = sqlite3.connect(self.path, timeout=self.lock_timeout_seconds)
-            connection.execute(
-                """
-                CREATE TABLE IF NOT EXISTS active_sessions (
-                    session_hash TEXT PRIMARY KEY,
-                    expires_at INTEGER NOT NULL
+            if initialize:
+                self.path.parent.mkdir(parents=True, exist_ok=True)
+                connection = sqlite3.connect(
+                    self.path, timeout=self.lock_timeout_seconds
+                )
+            else:
+                connection = sqlite3.connect(
+                    f"{self.path.resolve().as_uri()}?mode=rw",
+                    timeout=self.lock_timeout_seconds,
+                    uri=True,
+                )
+            if initialize:
+                connection.execute(
+                    """
+                    CREATE TABLE IF NOT EXISTS active_sessions (
+                        session_hash TEXT PRIMARY KEY,
+                        expires_at INTEGER NOT NULL
+                    )
+                    """
                 )
-                """
-            )
             return connection
         except (OSError, sqlite3.Error) as exc:
             raise SessionStoreError("Session registry is temporarily unavailable") from exc
 
     def activate(self, session_id: str, expires_at: int) -> None:
         try:
-            with self._connect() as connection:
+            with self._connect(initialize=True) as connection:
                 connection.execute(
                     "DELETE FROM active_sessions WHERE expires_at <= ?", (int(self.clock()),)
                 )
@@ -59,7 +69,6 @@ class SessionStore:
         now = int(self.clock())
         try:
             with self._connect() as connection:
-                connection.execute("DELETE FROM active_sessions WHERE expires_at <= ?", (now,))
                 row = connection.execute(
                     "SELECT expires_at FROM active_sessions WHERE session_hash = ?",
                     (self._digest(session_id),),